CVE-2025-66565
Description
Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID "00000000-0000-0000-0000-000000000000". The vulnerability occurs through two related but distinct failure paths, both ultimately caused by crypto/rand.Read() failures, compromising the security of all Fiber applications using these functions for security-critical operations. This issue is fixed in version 2.0.0-rc.4.
How to fix
- github.com/gofiber/utils/v22.0.0-rc.4 or later
- github.com/gofiber/utils1.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gofiber utils | v ≤ 1.2.0, 2.0.0 | — |
| github.com/gofiber/utils/v2Go | v < 2.0.0-rc.4 | 2.0.0-rc.4 |
| github.com/gofiber/utilsGo | v < 1.2.0 | 1.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.